CVE-2014-5120: Input Validation

Published Aug 23, 2014

Updated

gdctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.

Affected Software

68 affected components

PHP PHP=5.4.0

PHP PHP=5.4.0-beta2

PHP PHP=5.4.0-rc2

PHP PHP=5.4.1

PHP PHP=5.4.2

PHP PHP=5.4.3

PHP PHP=5.4.4

PHP PHP=5.4.5

PHP PHP=5.4.6

PHP PHP=5.4.7

PHP PHP=5.4.8

PHP PHP=5.4.9

PHP PHP=5.4.10

PHP PHP=5.4.11

PHP PHP=5.4.12

PHP PHP=5.4.12-rc1

PHP PHP=5.4.12-rc2

PHP PHP=5.4.13

PHP PHP=5.4.13-rc1

PHP PHP=5.4.14

PHP PHP=5.4.14-rc1

PHP PHP=5.4.15

PHP PHP=5.4.15-rc1

PHP PHP=5.4.16-rc1

PHP PHP=5.4.17

PHP PHP=5.4.18

PHP PHP=5.4.19

PHP PHP=5.4.20

PHP PHP=5.4.21

PHP PHP=5.4.22

PHP PHP=5.4.23

PHP PHP=5.4.24

PHP PHP=5.4.25

PHP PHP=5.4.26

PHP PHP=5.4.27

PHP PHP=5.4.28

PHP PHP=5.4.29

PHP PHP=5.4.30

PHP PHP=5.4.31

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

Event History

Aug 23, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5120?

CVE-2014-5120 has a medium severity level as it may allow file overwrite attacks.

How do I fix CVE-2014-5120?

To fix CVE-2014-5120, upgrade PHP to version 5.4.32 or 5.5.16 or later.

What versions of PHP are affected by CVE-2014-5120?

CVE-2014-5120 affects PHP versions 5.4.x prior to 5.4.32 and 5.5.x prior to 5.5.16.

What types of attacks can exploit CVE-2014-5120?

CVE-2014-5120 can be exploited to overwrite arbitrary files through crafted input to specific image processing functions.

Are there any workarounds for CVE-2014-5120?

Workarounds for CVE-2014-5120 include validating and sanitizing input paths, though upgrading is the best solution.